⬢ GM Security — 2026-06-30: $371K across 22 incidents

Daily crypto security briefing

2026-06-30 08:00 UTC · last 72h · 22 items · $371K reported losses · 49 sources

📊 Trend tracker

• 18 new today · 4 developing
• 7-day: 134 incidents, $886.4M stolen (+307% vs prior week)
• 30-day: 250 incidents, $1.10B stolen
• 7-day vectors: smart-contract bug (14), social engineering (9), private-key compromise (6)
• Repeat targets (30d): certik (8), polymarket (6), coinbase (6), bitcoin (6), tornadocash (5)

Last 24 hours

• [ADVISORY · NEW] @CertiK: Amazing write-up by our team member @xy9301 which examines vulnerability drift and reverse evolution in AI auditing sys… (CertiK)
• [ENFORCEMENT · NEW] Chinese billionaire Miles Guo gets 30 years in $1B crypto fraud case — ~$1.00B (crypto.news)
• [OTHER · NEW] Binance touts $300M compliance spend after $10.5B fraud blocks (crypto.news)
• [EXPLOIT · NEW] KuCoin faces scrutiny over alleged legal threat in stolen funds case — ~$250K (crypto.news)
• [ENFORCEMENT · NEW] Self-exiled Chinese billionaire sentenced to 30 years for fraud involving crypto (The Block)
• [ENFORCEMENT · NEW] SEC wins NanoBit crypto fraud case as court orders over $5.5M (crypto.news)
• [ADVISORY · NEW] @Quantstamp: The Zcash Orchard bug was patched, but nobody can prove it was never exploited. (@Quantstamp)
• [ADVISORY · NEW] @HalbornSecurity: Smart contract audits don't protect you from supply chain attacks. ⚠️ — ~$3.0M (@HalbornSecurity)
• [ENFORCEMENT · NEW] SEC wraps up NanoBit crypto fraud case in final judgment, ordering over $5 million in fines — ~$5.0M (The Block)
• [EXPLOIT · NEW] Private keys, not smart contracts, caused 40% of crypto's $16 billion hack losses. Here's whats being done. (CoinDesk)
• [ENFORCEMENT · NEW] Ukraine transfers $8.3 million in seized crypto amid potential plans for strategic reserve — ~$8.3M (CoinDesk)
• [OTHER · NEW] Crypto censorship tracker shows 3.7B frozen stablecoins and counting (Protos)
• [ENFORCEMENT · NEW] Ukraine Takes $8.3M in Seized Crypto Under State Management in a First (Decrypt)
• [OTHER · NEW] @CertiK: A better payment UX often comes with deeper protocol complexity. (CertiK)
• [OTHER · NEW] @SlowMist_Team: 🔥 Thanks to @MEeventHK for the invitation! (@SlowMist_Team)
• [OTHER · NEW] @BlockSecTeam: 🇭🇰 BlockSec is heading to #WikiEXPOHK2026. (@BlockSecTeam)

Earlier · 24–72h

• [EXPLOIT · DEVELOPING · day 7] @SlowMist_Team: 🚨SlowMist TI Alert🚨 — ~$121K (@SlowMist_Team)
• [EXPLOIT · NEW] AIDC — exploit — $121 (DeFiLlama Hacks DB)
• [ADVISORY · DEVELOPING · day 4] @ConsensysAudits: New on @MetaMask: Chonky, our AI-powered audit framework, and its core method - vulnerability mining. (ConsenSys Diligence)
• [OTHER · DEVELOPING · day 3] @_SEAL_Org: We’re proud to welcome @HyperFND as our newest Platinum Donor. (@_SEAL_Org)

🧠 Deep reads

• AMLBot Puts Polymarket Phishing Toll at $3.1M Across 11 Wallets, Funds Traced to Ethereum (The Defiant)
• DeFi drama: ENS governance battle, EF cuts and Gnosis reboot (Protos)

💡 Security thought-spark

Set a circuit breaker: auto-pause if outflows exceed N% of TVL in a single block. Bybit-scale losses happen in minutes, not days.

Full data: https://gmsecurity.net/briefing.json. Feedback or a source to add? [email protected]. George Donnelly offers Web3 development & security consulting.